chore: upgrade the MCP TypeScript SDK from 2.0.0-beta.5 to 2.0.0 #1988

Summary

The MCP TypeScript SDK has shipped 2.0.0 final (@modelcontextprotocol/client@2.0.0, dist-tag: latest). The Inspector is still pinned to the prerelease 2.0.0-beta.5 across all four SDK packages. Move to the stable release.

Current state

Root package.json (the SDK packages are declared at the root only — see AGENTS.md "Dependency placement"):

"@modelcontextprotocol/client": "2.0.0-beta.5",
"@modelcontextprotocol/core": "2.0.0-beta.5",
"@modelcontextprotocol/server": "2.0.0-beta.5",
"@modelcontextprotocol/server-legacy": "2.0.0-beta.5",

@modelcontextprotocol/ext-apps stays on its own ^1.7.4 line — it is a separate package and is not part of this bump (it is also on the TOLERATED_SKEW allowlist in scripts/verify-dep-lockstep.mjs).

Why now

• We are shipping against a prerelease of a dependency that reaches every client and every transport. A published Inspector resolving a beta of its core protocol library is a supply-chain and reproducibility liability we should not carry once a stable exists.
• Betas are eligible for unpublish/deprecation in a way a stable release is not.
• Any behavioral difference between beta.5 and 2.0.0 is currently unknown to us, and the longer we sit on the beta the larger the eventual diff.

Scope

1. Bump all four packages to 2.0.0 in the root package.json only — never in a clients/*/package.json (a second copy drifts from the root's; chore: declare the MCP SDK packages only at the repo root, so every client resolves one copy #1970).
2. Re-run npm install at the root so the cascade re-syncs every client, and commit the lockfile.
3. Read the SDK's 2.0.0 changelog/release notes for anything between beta.5 and final, and adapt call sites — the surfaces most likely to be touched:
   • core/mcp/ — InspectorClient, transports, the raw-wire tasks/* channel (modernTaskSchemas.ts), and the era negotiation added in Era-aware connection model & capability gating #1626.
   • core/auth/ — the SDK-driven issuer binding (SEP-2352) and force-reauthorization paths.
   • core/json/xMcpHeader.ts and the two tools/call paths — the Inspector builds Mcp-Param-* headers itself (tools/call omits SEP-2243 Mcp-Param-* headers (x-mcp-header mirroring), rejected by strict modern servers #1846) because the SDK only mirrors inside client.callTool().
   • test-servers/src/ — createMcpHandler / createTestServerHttp and the modern-era leg.
4. Check zod — the SDK's schema surface is built out of zod generics, and a skew there previously exhausted the tsc heap (chore(deps): zod 4.4 blows the tsc heap in clients/web — held at ~4.3.6 #1896). If 2.0.0 moves its zod range, bump zod in every install that declares it and confirm npm run verify:dep-lockstep stays green.
5. Update any doc that names a version.

Acceptance criteria

• All four SDK packages at 2.0.0 in the root package.json; no SDK package declared in any clients/*/package.json.
• Lockfiles updated and committed.
• npm run ci passes end to end (validate → coverage → verify:build-gate → smoke → Storybook), including verify:dep-lockstep.
• npm run pack:verify passes — the published-tarball path resolves the new SDK from the root manifest.
• The era-sensitive showcase configs still behave as documented in the root README: modern-mrtr-http.json, modern-network-http.json, tasks-{legacy,modern}-http.json, subscriptions-{legacy,modern}-http.json, logging-{legacy,modern}-http.json, and mcp-app-http.json.
• Any SDK behavior change between beta.5 and 2.0.0 that affects the Inspector is noted in the PR body.

Notes

Per the SDK-v2 backward-compat principle we have followed throughout: legacy-era features (tasks, logging, resource subscriptions) stay working via era-conditional exposure. If 2.0.0 removes more legacy surface, the fix is to drive it from the Inspector side — as we already do for the modern tasks extension — not to drop the capability.